Privacy Policy

poddle is built to hold as little of your data as possible. The broker keeps credentials in a sealed vault; your code and prompts run in pods on infrastructure you control. This policy explains what we do collect, why, and the rights you have over it.

This Privacy Policy describes how datadir s. r. o. ("datadir", "we", "us"), operator of poddle, processes personal data under the EU General Data Protection Regulation (GDPR) and Slovak data-protection law. It applies to poddle.dev and the poddle service. We are the controller for that data. Registered office: Bauerova 1205/7, 040 23 Košice, Slovakia; IČO 57 582 904; registered in the Commercial Register of the City Court Košice, Section Sro, Insert No. 65729/V.

What we collect

• Account data - your name, email, and organisation, so you can sign in and we can contact you.
• Billing data - handled by our payment processor; we store a customer reference and invoices, not full card numbers.
• Usage & telemetry - coarse product events and error diagnostics to keep the service reliable and secure.
• Audit records - which identity performed which action and when, so your team has an accountable trail. These records are secret-free by construction: no request bodies, no credentials.
• Support communications - anything you send us when you ask for help.

What we do not want

We do not want your vendor secrets or your source code. Credentials are sealed in the broker vault and injected on the wire; pods run on your own cloud or self-hosted compute. We are not in the path of your repositories or your prompts, and we do not use your data to train models.

How we use it, and our legal basis

• To provide and operate the service, and to bill you - to perform our contract with you (GDPR Art. 6(1)(b)).
• To secure the service, prevent fraud and abuse, and improve reliability - our legitimate interests in running a safe, dependable product (Art. 6(1)(f)).
• To meet accounting, tax, and other legal duties - to comply with a legal obligation (Art. 6(1)(c)).
• For anything optional, such as non-essential analytics - only with your consent (Art. 6(1)(a)), which you may withdraw at any time.

How we protect it

Credentials are held in a sealed vault and injected only on the broker-to-provider hop; they are never materialised inside a pod. Data in transit is encrypted with TLS and data at rest is encrypted. Access is least-privilege and logged, and our audit log is hash-chained and tamper-evident. No system is perfectly secure, but the product is designed so a compromised pod has no vendor key to steal.

Sharing & sub-processors

We share personal data only with vetted sub-processors that help us run poddle - cloud hosting, payment processing, error monitoring, and email delivery - each under a GDPR-compliant data-processing agreement and only for the purposes above. We do not sell personal data or share it for advertising. A current list of sub-processors is available on request, and we give advance notice of material changes.

International transfers

We prefer to keep data in the EU/EEA. Where a sub-processor transfers data outside the EEA, we rely on an adequacy decision or appropriate safeguards - typically the European Commission's Standard Contractual Clauses, with additional measures where needed.

Retention

• Account data - kept for the life of your account and deleted or anonymised within 90 days of closure, unless we must keep it longer.
• Invoices & accounting records - retained for as long as Slovak accounting and tax law requires (generally up to 10 years).
• Audit records - retained per your account's retention settings; you control them and can export or delete them.
• Telemetry & diagnostics - short-lived and aggregated where possible.

Automated decisions & children

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. poddle is a tool for professional developers; it is not directed at children, and we do not knowingly collect data from anyone under 16.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction, and portability, and you may object to processing based on legitimate interests. To exercise any of these, email privacy@datadir.co; we respond within one month. You also have the right to lodge a complaint with your supervisory authority - in Slovakia, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk).

Cookies

poddle.dev uses only what's necessary to serve the site and, where enabled, privacy-friendly, cookieless analytics. We do not use advertising or cross-site tracking cookies.

Changes

We post any changes here and update the date above; we notify account holders of material changes before they take effect.

Contact

Privacy questions or requests: privacy@datadir.co. For anything else, hello@datadir.co.